HAPPY SNOW MONKEY Add-ons WP Registry grade B. Medium-severity findings · 2 findingsWP RegistryMedium-severity findings · 2 findingsOpen the reportB

Medium-severity findings.

Audited release

0.3.4

Findings

2

Worst severity

medium

Content hash

f04981b0e6b9f1c7d10d1541… Copy

Findings

• medium Dashboard widget discloses all active plugins and versions to any logged-in user

  information_disclosure

  hsma_dashboard_widget() iterates get_option('active_plugins') and prints each plugin's Name and Version. The widget is registered on wp_dashboard_setup without any current_user_can() restriction and is enabled by default on activation, so Subscribers/customers who open the dashboard get a full, versioned plugin inventory useful for targeting known vulnerabilities.

  inc/show-dashboard-widget.php:54-127

  Recommendation

  Only register the widget when current_user_can('manage_options') (or 'activate_plugins').

• low Unescaped HTTP_USER_AGENT echoed in dashboard widget

  missing_escaping

  The widget echoes $_SERVER['HTTP_USER_AGENT'] without escaping. Because it reflects the viewer's own request header, it is not practically exploitable against other users (self-XSS), but it is a missing-escaping defect.

  inc/show-dashboard-widget.php:98-103

  Recommendation

  Wrap with esc_html( wp_unslash( ... ) ).

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.